vibora 9.3.2 → 9.4.0

package/bin/vibora.js

@@ -45126,7 +45126,7 @@ function installUv() {
 var package_default = {
   name: "vibora",
   private: true,
-  version: "9.3.2",
+  version: "9.4.0",
   description: "Harness Attention. Orchestrate Agents. Ship.",
   license: "PolyForm-Perimeter-1.0.0",
   type: "module",
@@ -45651,6 +45651,7 @@ import { join as join4 } from "path";
 // plugins/vibora-opencode/index.ts
 var vibora_opencode_default = `import type { Plugin } from "@opencode-ai/plugin"
 import { appendFileSync } from "node:fs"
+import { execFile } from "node:child_process"
 
 declare const process: { env: Record<string, string | undefined> }
 
@@ -45669,6 +45670,24 @@ const log = (msg: string) => {
   }
 }
 
+/**
+ * Execute vibora command using execFile with shell option for proper PATH resolution.
+ * Using execFile with explicit args array prevents shell injection while shell:true
+ * ensures PATH is properly resolved (for NVM, fnm, etc. managed node installations).
+ */
+async function runViboraCommand(args: string[]): Promise<{ exitCode: number; stdout: string; stderr: string }> {
+  return new Promise((resolve) => {
+    execFile(VIBORA_CMD, args, { shell: true }, (error, stdout, stderr) => {
+      if (error) {
+        const execError = error as NodeJS.ErrnoException
+        resolve({ exitCode: execError.code ? 1 : 1, stdout: stdout || '', stderr: stderr || execError.message || '' })
+      } else {
+        resolve({ exitCode: 0, stdout: stdout || '', stderr: stderr || '' })
+      }
+    })
+  })
+}
+
 let mainSessionId: string | null = null
 const subagentSessions = new Set<string>()
 let pendingIdleTimer: ReturnType<typeof setTimeout> | null = null
@@ -45690,7 +45709,7 @@ export const ViboraPlugin: Plugin = async ({ $, directory }) => {
   } else {
     deferredContextCheck = Promise.all([
       $\`\${VIBORA_CMD} --version\`.quiet().nothrow().text(),
-      $\`\${VIBORA_CMD} current-task --path \${directory}\`.quiet().nothrow(),
+      runViboraCommand(['current-task', '--path', directory]),
     ])
       .then(([versionResult, taskResult]) => {
         if (!versionResult) {
@@ -45735,11 +45754,10 @@ export const ViboraPlugin: Plugin = async ({ $, directory }) => {
     ;(async () => {
       try {
         log(\`Setting status: \${status}\`)
-        const res =
-          await $\`\${VIBORA_CMD} current-task \${status} --path \${directory}\`
-            .quiet()
-            .nothrow()
-        if (res.exitCode !== 0) log(\`Status update failed: \${res.stderr}\`)
+        const res = await runViboraCommand(['current-task', status, '--path', directory])
+        if (res.exitCode !== 0) {
+          log(\`Status update failed: exitCode=\${res.exitCode}, stderr=\${res.stderr}\`)
+        }
       } catch (e) {
         log(\`Status update error: \${e}\`)
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibora",
-  "version": "9.3.2",
+  "version": "9.4.0",
   "description": "Harness Attention. Orchestrate Agents. Ship.",
   "license": "PolyForm-Perimeter-1.0.0",
   "repository": {

package/server/index.js

@@ -5824,8 +5824,7 @@ class BufferManager {
   }
   getContents() {
     const raw2 = this.chunks.map((c) => c.data).join("");
-    const filtered = this.filterProblematicSequences(raw2);
-    return this.getMouseModeSequences() + filtered;
+    return this.filterProblematicSequences(raw2);
   }
   clear() {
     this.chunks = [];